3

Is it possible to use zero-copy packets mechanism for reading packets using libpcap on Linux? (I'm using CentOS 6.2) If yes, can I see any example of code?

Dima
  • 1,253
  • 3
  • 21
  • 31

2 Answers2

3

Yes, libpcap 1.0 and later do it, although later versions of libpcap have fixed a number of bugs, so the later the version of libpcap being used, the better it works. Code written to the standard libpcap APIs will use zero-copy capturing on Linux with libpcap 1.0 and later.

(Netsniff-ng has its own code to capture packets, rather than using libpcap.)

  • Do you mean libpcap0.8 1.* have zero-copy? – SuB Apr 22 '15 at 05:42
  • 1
    "libpcap 1.0 and later do it" includes "the Debian package that is very confusingly called libpcap0.8 has it in those versions that package libpcap 1.0 and later". Or, to put it another way, you can replace "0.8" with "my hovercraft is full of eels" in the name of the Debian package and the new package name will not tell you any more or less about the actual libpcap version in the package than the old package name did; the "0.8" should be thought of as decorative, rather than as any sort of indication of the libpcap version number. –  Apr 22 '15 at 07:49
1

Yes, apparently netsniff-ng does it. I recommend checking out its code.

Michael Slade
  • 13,802
  • 2
  • 39
  • 44